This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis β
Q1What is this vulnerability? (Essence + Consequences)
π¨ **Essence**: iControlWP < 4.4.5 suffers from **PHP Object Injection**. π₯ **Consequences**: Attackers can inject malicious PHP objects, leading to full **Remote Code Execution (RCE)**.β¦
π¦ **Affected**: WordPress Plugin **iControlWP**. π **Version**: Versions **4.4.5 and earlier**. Vendor: **paultgoodchild**. If you use this plugin for multi-site management, you are at risk.
Q4What can hackers do? (Privileges/Data)
π **Privileges**: **Full Control**. CVSS Score is **Critical (9.8)**. Hackers gain **High Confidentiality, Integrity, and Availability** impact. They can execute arbitrary PHP code, steal data, or deface the site.
Q5Is exploitation threshold high? (Auth/Config)
β‘ **Threshold**: **LOW**. CVSS Vector: `AV:N/AC:L/PR:N/UI:N`. π **Network**: Remote. π **Auth**: None required. π±οΈ **UI**: None required. This is an easy, unauthenticated exploit.
Q6Is there a public Exp? (PoC/Wild Exploitation)
π **Exploit Status**: Public references exist (WordFence, WP Trac). While specific PoC code isn't in the `pocs` array, the vulnerability details are well-documented.β¦
π **Self-Check**: Scan for **iControlWP** plugin. π Check file paths: `src/api/RequestParameters.php` or `lib/src/LegacyApi/RequestParameters.php`. Look for version **4.4.5** or older in your WordPress dashboard.
Q8Is it fixed officially? (Patch/Mitigation)
β **Fix**: **Yes**. Update iControlWP to the latest version. The references point to changesets in the WordPress plugin repository. Patching resolves the deserialization flaw in `RequestParameters.php`.
Q9What if no patch? (Workaround)
π§ **No Patch?**: **Disable** the plugin immediately if not needed. π **Isolate** the WordPress site. Use a WAF to block suspicious PHP serialization payloads. Remove the plugin files from the server if possible.
Q10Is it urgent? (Priority Suggestion)
π₯ **Urgency**: **CRITICAL**. With a CVSS of 9.8 and no auth required, this is a **top-priority** fix. Update **NOW** to prevent immediate compromise. Do not wait.